Privacy Notice

TRIBL ("TRIBL", "we", "us") is operated by Tribl AB, a Swedish company (company number 559427-1511), Kungsgatan 10, 111 43 Stockholm, Sweden. Tribl AB is the data controller for the personal data described in this notice.

For any privacy question or to exercise your rights, email info@tribl.app. For help with your account, you can also write to support@tribl.app.

This notice explains what personal data we process when you visit tribl.app (including our blog), create a Creator account, support a Creator as a Fan, book a session with a Creator, fill in a form on a Creator's page, join a waitlist, or contact us; why we do it; which service providers help us; and what rights you have. It should be read together with our Terms & Conditions and Cookie Notice. Words such as "personal data" and "processor" are explained in section 15.

Creators (people with a TRIBL account):

• Account data: username, email address, phone number, password (stored only as a secure hash), sign-in method (email, Google or Apple), country, currency and account settings.
• Profile data you choose to publish: name, profile and cover photos, bio, links, social media handles, memberships, gift-card blocks, media kit and other page content.
• Identity verification data, needed before you can receive payouts: name, date of birth, nationality, address and proof of address, ID document details and images, a selfie and liveness check, and the result of sanctions and politically exposed person (PEP) screening. For Creators in the USA, the Social Security Number our payment provider requires, which we pass to the payment provider and do not keep.
• Payout data: bank account details (account holder, IBAN, SWIFT/BIC, account number), crypto wallet addresses, and your account ID with our payment provider.
• Transaction data: tips, memberships, gift cards and other payments you receive, our fees, payouts and balances.
• Emails you send to your Fans through TRIBL and the templates you design.
• Booking data, if you offer sessions: what you offer (description, images, price, length and where it takes place, such as a meeting link), your available hours and time zone, the automatic messages you set, and the bookings Fans make with you.
• Connected calendar data, if you connect Google Calendar or Microsoft Outlook: the email address of the account you connect, the calendars you choose, the times you are busy on them (only when each starts and ends), and the events we add to your calendar for your bookings (see section 3.18).
• Connected video data, if you connect Zoom: the email address, user and account IDs and plan of the Zoom account you connect, and the meetings we create for your bookings (see section 3.18).
• Calendly data, if you connect Calendly: the email address of your Calendly account, the times you are busy in Calendly, and your upcoming Calendly bookings (what was booked, when, and the name and email address of who booked it), shown to you in Bookings and not stored (see section 3.18).
• Activity data: when you last used your account (signing in, receiving payments, payouts), so we can apply the retention rules in section 9.

Fans (people who tip, join a membership, buy a gift card or book a session):

• Name, email address and, where needed for the payment, phone number, billing address and date of birth.
• Transaction data: what you paid, to which Creator, when and how. Card details are entered directly with our payment provider; TRIBL never sees or stores your full card number.
• The IP address, approximate location and device type used at checkout, for fraud prevention.
• For gift cards: the name you give as the sender.
• For bookings: the session and time you chose, your time zone, your answers to the Creator's questions and, if the Creator asks for it, your billing address. If the Creator has connected Google Calendar or Microsoft Outlook, your name and email address, the session and its time are added to the event in the Creator's own calendar (see section 3.18).
• In some cases, identity verification data (as above) when it is required for a payment.
• Emails a Creator you support sends you through TRIBL, which the Creator can personalise with the details you gave at checkout (such as your name).

Everyone who visits tribl.app:

• Technical data: IP address, approximate location (country and city derived from the IP address), browser and device type, and the pages you visit.
• When you view a Creator's page or click one of their links, an anonymous event with the country, city and device type, so the Creator can see statistics about their audience (see section 3.7).
• Cookie and similar data, as described in our Cookie Notice. Analytics and marketing tools are only used if you consent.

People who fill in a form on a Creator's page: the answers you give, which are whatever the Creator asks for (often your name, email address, phone number or a message); whether you ticked a box to hear from the Creator, and the exact words you agreed to; when you sent the form; and your device type (see section 3.16).

People who buy a digital product from a Creator: your name and email address, your answers to the Creator's checkout questions, what you bought and what you paid, your confirmation that you want access straight away and lose your right of withdrawal (with the time and the exact wording), your device type, and how often you opened your link and downloaded (see section 3.17).

People who join a waitlist: your email address, the list you joined, whether you are a creator or a brand (Dealroom), the idea you type for our AI builder if you choose to, the page you signed up on, and when you joined (see section 3.14).

Anyone who contacts us: your message, your contact details and our reply.

We do not ask for special categories of data (such as health, religion or sexual orientation). Identity verification involves comparing your face with your ID document; see sections 3.3 and 5.

Below, our processing is grouped by purpose. Under each purpose we list every service provider involved, what it does, the personal data it handles, the legal basis, and where the data is processed. Open a purpose to see the details. Unless we say otherwise, providers act as our processors: they may only use the data on our instructions, under a data processing agreement. Providers marked as independent controllers decide themselves how they use the data, under their own privacy policy.

When we rely on legitimate interest, we have weighed our interest against your rights and expectations. You can object at any time (see section 10). If you do not give us the data we need for a contract or a legal obligation, such as identity details for a payout, we cannot provide that part of the service.

We use the automated checks described in section 3.4 to keep TRIBL safe:

• Text and links are screened by OpenAI's models. Content that is flagged is not saved, and you are asked to change it. Flagged content is recorded for our team.
• Images are screened for explicit content by Amazon Rekognition. Explicit images are rejected and recorded, and our team is alerted. After three rejected images, the account is blocked automatically until our team has reviewed it.
• Celebrity matching: images that pass are compared, by face, with Amazon's index of well-known public figures. A strong match (a confidence above 95%) does not block the upload: it is sent to our team, who check whether someone may be impersonating that person. The comparison is only against public figures in Amazon's index; we do not use it to identify you or to build a profile of your face.
• Identity verification and screening: Didit compares your ID document with your selfie and screens you against sanctions and PEP lists. If the screening finds a possible sanctions or PEP match, or the name or date of birth on your document does not match your account, your account is put on hold automatically and payouts are paused until our team has reviewed the case.

These automatic steps are temporary safety measures; final decisions to remove content, close an account or refuse a payout are taken by a person. If you disagree with the outcome of a check, you can ask for a human review, give your point of view and contest the decision by emailing info@tribl.app.

With your consent, our advertising partners (section 3.13) may use data about your visit to build interest profiles for ad targeting on their platforms.

• Directly from you, when you sign up, join a waitlist, fill in a form, edit your page, pay or contact us.
• From Google or Apple, if you sign in with them (name, email address and account ID).
• From our identity verification and payment providers (the outcome of checks and the status of payments and payouts).
• Earlier, from Instagram, TikTok or YouTube through Phyllo, if you connected them to your media kit (see section 3.8).
• From Google, if a Creator connects Google Calendar: the email address of the connected account, their calendar list and busy times (see section 3.18).
• From Microsoft, if a Creator connects Microsoft Outlook: the email address of the connected account, whether it is a work, school or personal account, their calendar list and busy times (see section 3.18).
• From Zoom, if a Creator connects Zoom: the email address, user and account IDs and plan of the connected account (see section 3.18).
• From Calendly, if a Creator connects Calendly: the email address of the connected account, the times they are busy, and their upcoming Calendly bookings, including the name and email address of the person who booked (see section 3.18).
• From your browser and device, as described above.

We do not sell your personal data. We share it only with:

• The public: your Creator page and media kit are visible to anyone, and Creators see the name and message of Fans who support them, and the details Fans give when they book a session (section 3.15).
• The Creator whose form you fill in, who receives your answers, and any app that Creator has connected to the form (section 3.16).
• The Creator whose digital product you buy, who receives your name, email address, checkout answers, what you bought and how many times you downloaded it (section 3.17).
• The Creator's calendar provider, if the Creator you book has connected Google Calendar or Microsoft Outlook: the booking is added to the Creator's own calendar with your name and email address (section 3.18).
• Service providers acting as our processors, listed in section 3.
• Independent controllers listed in section 3: Stripe for its own legal duties, Google and Apple for sign-in, Beefree for the technical data it collects, and (with your consent) Meta, TikTok, Google, X and Quora for advertising.
• Authorities, courts and advisers, where the law requires it or it is needed to establish, exercise or defend legal claims, for example the police, the tax authority or our auditors.
• A buyer or successor, if all or part of TRIBL is sold or merged, under the same protections.

Some providers in section 3 are based in, or access data from, countries outside the EU/EEA, mainly the USA. We only allow this when the transfer is protected: either the recipient is certified under the EU–US Data Privacy Framework (for example Google, Microsoft, Meta, Amazon and Stripe), the European Commission has decided the country gives adequate protection, or we use the European Commission's Standard Contractual Clauses together with additional safeguards where needed. You can ask us for a copy of the relevant safeguards at info@tribl.app.

• Account and profile data: for as long as your account exists. When you delete your account we delete your profile, published content, uploaded images, payout details, connected social accounts and statistics. We keep only the records described below, and remove from them what we no longer need (such as addresses, phone numbers and device details).
• Transaction and accounting records: 7 years after the end of the financial year, as required by the Swedish Accounting Act. We keep the name, email address, country and IP address of the person who paid, and the amounts.
• Records of the fees TRIBL charges Creators, and the evidence of where the Creator is located (country of residence, bank account country and the IP address used at sign-up): 10 years after the end of the year, as required for VAT records under EU rules.
• Identity verification and screening records: for as long as your account is active, and then for one more year, after which we and our verification provider delete them. Your account stops being active when you delete it, or when it has not been used for 6 months after your verification. Using it means signing in, receiving or making a payment, a payout, a transfer to your account or a top-up. These are the same events our payment provider, Stripe, uses to decide whether an account is active. If you come back after your records were deleted, you will need to verify again.
• Payout account with our payment provider: when we delete the verification records of an inactive Creator, we also close their Stripe account, once any balance has been paid out. We never close it while money is owed to you.
• Anonymous page-view and click statistics: for as long as the Creator's account exists.
• Security and technical logs: 90 days for logs of requests to TRIBL, and 180 days for error logs and logs of calls to our service providers. One-time verification codes: 1 hour.
• Waitlist entries: until 6 months after we send your invite, then we delete them. If we have not invited you within 2 years of joining, for example because the product has not opened, we delete your entry then. We delete it straight away if you withdraw your consent, ask us to, or delete a TRIBL account that uses the same email address. We may keep counts of what people asked our AI builder to do (such as how many asked for memberships), which do not identify anyone.
• Bookings: for as long as the Creator's account exists, so the Creator keeps a record of their sessions. A time held for a payment that was never completed is deleted 7 days after the hold ran out. If you delete your Fan account or ask us to erase your data, we remove your name, email address, answers and billing address from your bookings. The payment record is kept as described above for transaction records.
• Answers sent through a form on a Creator's page: they belong to the Creator, so we keep them for the Creator until the Creator deletes them or deletes their account. We don't delete them on a schedule. Deleting your own TRIBL account doesn't delete answers you sent to a Creator; see section 10 to ask for that.
• Digital product orders: for as long as the Creator's account exists, so you can keep downloading what you bought and the Creator keeps a record of their sales. A checkout that was never paid is deleted after 30 days. If you ask us to erase your data, we remove your name, email address, answers and link from your orders, and the link stops working. The payment record and your confirmation about the right of withdrawal are kept as described above for transaction records.
• Connected calendars and video accounts: the connection and its encrypted access are kept until the Creator disconnects or deletes their TRIBL account. If the Creator removes Tribl in their Google, Microsoft or Calendly account instead, the access stops working and the connection is kept, marked for reconnecting, until they disconnect; if they remove Tribl in Zoom, Zoom tells us and we delete the connection. Zoom meetings already created stay in the Creator's Zoom account. Busy times are not stored (we keep them in memory for up to 30 minutes). Events already added to a Creator's calendar stay there, under the Creator's control; a Creator's data export lists their connections without the access itself.
• Support messages: for as long as needed to handle your request and any follow-up.
• Cookies: see the durations in our Cookie Notice.

Providers acting as independent controllers (such as Stripe) keep data for the periods set out in their own policies.

Under the GDPR you have the right to:

• get a copy of the personal data we hold about you (access);
• have inaccurate data corrected (rectification);
• have your data deleted (erasure), unless we must keep it by law;
• have our use of your data restricted;
• receive the data you gave us in a machine-readable format (portability);
• object to processing based on legitimate interest, including profiling, and to direct marketing at any time;
• not be subject to a decision based solely on automated processing that significantly affects you (see section 5);
• withdraw your consent at any time, without affecting what we did before. For cookies, use Cookie Settings. To leave a waitlist, email info@tribl.app.

Creators and Fans can edit most data and delete their account in their account settings. If you are on a waitlist, email us from the address you signed up with to see, change or delete your entry, or to leave the list. For answers you sent through a form on a Creator's page, the Creator is responsible: contact them directly, or email us and we will pass your request on and help the Creator respond. To get a copy of your data, or for anything else, email info@tribl.app. We will reply within one month, and may need to confirm your identity first.

If you are unhappy with how we handle your data, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), www.imy.se, or the data protection authority where you live or work. We'd appreciate the chance to sort it out with you first.

TRIBL is for people aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has given us personal data, contact us and we will delete it.

We use technical and organisational measures to protect your data, including encryption in transit (HTTPS), hashed passwords, access controls, restricted access to verification data, and hosting with established providers. No system is completely secure; if a breach is likely to affect you, we will tell you and the authorities as the law requires.

Creator pages link to other websites and social networks. When you follow such a link, the other site's own privacy policy applies.

We may update this notice when our services, our providers or the law change. We will change the "Last updated" date and, for significant changes, tell you by email or on the site before they take effect.

• Personal data: any information that relates to an identified or identifiable person.
• Processing: anything done with personal data, such as collecting, storing, using, sharing or deleting it.
• Controller: the organisation that decides why and how personal data is processed. Joint controllers decide this together.
• Processor: a provider that processes personal data on a controller's behalf and instructions.
• Creator and Fan: as defined in our Terms & Conditions.
• GDPR: the EU General Data Protection Regulation (EU) 2016/679.